admission: default resource group (id=1) with configurable Weight_CPU

Seed `system.resource_groups` with `(id=1, name='default', weight_cpu=, max_cpu=false)` on migration (extend [pkg/upgrade/upgrades/v26_3_resource_groups.go:19](https://github.com/cockroachdb/cockroach/blob/master/pkg/upgrade/upgrades/v26_3_resource_groups.go#L19)), expose the default's `Weight_CPU` via a cluster setting so behavior is tunable without DDL, route all requests with `ResourceGroupID == 0` to id=1 in the AC granter, and refuse `DROP RESOURCE GROUP default`. Today [`builtinGroupConfigs`](https://github.com/cockroachdb/cockroach/blob/master/pkg/util/admission/resource_group_config_holder.go#L117) covers only the two built-ins (high/low) and there's no explicit default. This is what makes "zero behavior change until a DBA creates a second group" true in practice. Persistent user/role/database mappings are still M3.

Epic CRDB-66372

Jira issue: CRDB-66385

Start with pkg/upgrade/upgrades/v26_3_resource_groups.go:19 and pkg/util/admission/resource_group_config_holder.go:117, then trace the AC granter and existing resource-group DDL handling. Done means migration seeds id=1, the default Weight_CPU is tunable by cluster setting, zero IDs route to id=1, and DROP RESOURCE GROUP default is refused without implementing the M3 mappings.

Written by the indexing model from the issue text.